The presentation that was given by Maty Siman, Checkmarx's CTO during the OWASP NYC/NJ local chapter meeting held on the 11th of April 2013.

1. OWASP NYC
Maty
Title in white and bold Siman

2. About
Maty Siman, CISSP
CTO, Founder – Checkmarx:
Leading SAST (“Source Code Analysis”) Vendor
Hundreds of customers WW
Secures SalesForce AppExchange market
Title in white and bold
“Visionary” by Gartner

3. Graph Visualization
Title in white and bold

4. Issues at hand – size, complexity, volume
The biggest challenge of current source code
analysis solutions is size-
How to deliver:
1. Usable results
2. Automatically
Title in white and bold
3. Out-of-the-box
4. Actionable
for extra large code bases with thousands+ of
results

5. Issue
• Findings thousands accurate results, does not
make us happy …
• Webgoat, for example, has hundreds of XSS
• We’ll narrow this down to 10 fixing places
Title in white and bold

6. Current situation
• Each result has a data flow, presented
independently from other findings.
Title in white and bold

7. Single Data Flow Path - XSS
Request.QueryString*“param1”+;
String s = Request.QueryString*“param1”+;
…
s
Response.Write(s);
Response.Write(s);
Title in white and bold

8. Current situation
• One is easy.
• And 14?
Title in white and bold

9. Many Single-Path – XSS – a lot of work
Title in white and bold

10. But …
• What do they have in common?
Title in white and bold

11. Combined paths
Title in white and bold

12. Can we …
• Point, click and check without even READING
the source code?
• “What if I fix here? Or here?”
Title in white and bold

13. Here it is more effective
Title in white and bold

14. What-If I fix here?
Title in white and bold

15. And here?
Title in white and bold

16. Automatic “What-if” => Best Fix Location
Max-Flow-Min-Cut (http://en.wikipedia.org/wiki/Max-flow_min-cut_theorem_
Title in white and bold

17. Simplifying the graph – step 1 - grouping
Title in white and bold

18. Simplifying the graph – step 2 –
homeograph’ing (http://enc.tfode.com/Homeomorphism_(graph_theory))
Title in white and bold

19. Simplifying the graph - output
Title in white and bold

20. Simplifying the graph - output
Title in white and bold

21. Compare the three
Title in white and bold
Space Invader

22. Benefits
• Gives you the correlation between findings of
the same type (SQLi) and different types.
• You are not dealing with individual findings –
but with a complete system
•Title inyour time bold
Use white and better

23. Thank you
Title in white and bold
maty@checkmarx.com